Vulnerabilities

TI-2026-30239 CVE-2026-41724 · GHSA-76rr-q8xf-r868

Cross-site scripting in VMware VCF operations

LOW 37

VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to create policies, views or text-widgets may be able to inject scripts to perform admini…

CVSS 3.1HIGH 8.0 Network Low privileges User interaction EPSS 0.00313 Published 2026-06-08 No fix listed CWE-79

TI-2026-30238 CVE-2026-41723 · GHSA-wfp8-3hcq-xm45

Cross-site scripting in VMware VCF operations

LOW 37

VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to create policies, views or text-widgets may be able to inject scripts to perform admini…

CVSS 3.1HIGH 8.0 Network Low privileges User interaction EPSS 0.00399 Published 2026-06-08 No fix listed CWE-79

TI-2026-30237 CVE-2026-41722 · GHSA-3q9r-4xf6-m724

Cross-site scripting in VMware VCF operations

LOW 37

VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to create policies, views or text-widgets may be able to inject scripts to perform admini…

CVSS 3.1HIGH 8.0 Network Low privileges User interaction EPSS 0.00302 Published 2026-06-08 No fix listed CWE-79

TI-2026-18248 CVE-2026-22721 · GHSA-p743-h3f6-5f74

VMware Aria Operations privilege escalation vulnerability

LOW 35

VMware Aria Operations contains a privilege escalation vulnerability.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00739 Published 2026-02-25 Fixed in 8.18.6, 5.2.3 +1 CWE-269

TI-2026-18247 CVE-2026-22720 · GHSA-rr3q-q2xp-f894

VMware Aria Operations stored cross-site scripting vulnerability

MEDIUM 41

VMware Aria Operations contains a stored cross-site scripting vulnerability.

CVSS 3.1CRITICAL 9.0 Network Low privileges User interaction EPSS 0.00447 Published 2026-02-25 Fixed in 8.18.6, 5.2.3 +2 CWE-79

TI-2026-18246 CVE-2026-22719 · GHSA-2hp7-6cr6-jvxh

VMware Aria Operations command injection vulnerability

CRITICAL 94KEV

VMware Aria Operations contains a command injection vulnerability.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.18321 Published 2026-02-25 Fixed in 8.18.6, 9.0.2 +1 CWE-77

TI-2025-27491 CVE-2025-41244 · GHSA-76fp-m4vp-hxrq

VMSA-2025-0015: VMware Aria Operations and VMware Tools updates address multiple…

CRITICAL 93KEV

VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.15841 Published 2025-09-29 Fixed in 9.0.1.0, 13.0.5.0 +2 CWE-267

TI-2025-16155 CVE-2025-22245 · GHSA-p5wf-c3gw-cq7c

Cross-site scripting in VMware NSX

LOW 26

VMware NSX contains a stored Cross-Site Scripting (XSS) vulnerability in the router port due to improper input validation.

CVSS 3.1MEDIUM 5.9 Network High privileges User interaction EPSS 0.00263 Published 2025-06-04 No fix listed CWE-79

TI-2025-16154 CVE-2025-22244 · GHSA-xr62-x8gm-j2h5

Cross-site scripting in VMware NSX

LOW 30

VMware NSX contains a stored Cross-Site Scripting (XSS) vulnerability in the gateway firewall due to improper input validation.

CVSS 3.1MEDIUM 6.9 Network High privileges User interaction EPSS 0.00315 Published 2025-06-04 No fix listed CWE-79

TI-2025-16153 CVE-2025-22243 · GHSA-ccxh-4mwr-475q

VMware NSX Manager UI is vulnerable to a stored Cross-Site Scripting (XSS) attack due to improper input validation.

LOW 33

VMware NSX Manager UI is vulnerable to a stored Cross-Site Scripting (XSS) attack due to improper input validation.

CVSS 3.1HIGH 7.5 Network High privileges User interaction EPSS 0.00341 Published 2025-06-04 No fix listed CWE-79

TI-2025-27478 CVE-2025-41231 · GHSA-6pf2-52g7-p22m

VMware Cloud Foundation Missing Authorisation Vulnerability

LOW 31

VMware Cloud Foundation contains a missing authorisation vulnerability.

CVSS 3.1HIGH 7.3 Local No auth No interaction EPSS 0.00173 Published 2025-05-20 Fixed in 5.2.1.2 CWE-862

TI-2025-16159 CVE-2025-22249 · GHSA-2r69-79fj-p7wm

VMSA-2025-0008: VMware Aria automation updates address a DOM based Cross-site scripting vulnerability (CVE-2025-22249)

LOW 36

VMware Aria automation contains a DOM based Cross-Site Scripting (XSS) vulnerability.

CVSS 3.1HIGH 8.2 Network No auth User interaction EPSS 0.00358 Published 2025-05-13 Fixed in 8.18.1 patch2, 8.18.1 patch 2 CWE-79

TI-2025-16137 CVE-2025-22226 · GHSA-37f6-vjg7-8c6c

Out-of-bounds read in ESXi

CRITICAL 88KEV

VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability due to an out-of-bounds read in HGFS.

CVSS 3.1HIGH 7.1 Local No auth No interaction EPSS 0.01633 Published 2025-03-04 Fixed in ESXi80U3d-24585383, ESXi80U2d-24585300 +3 CWE-125

TI-2025-16136 CVE-2025-22225 · GHSA-2cxw-wgvv-24jj

Out-of-bounds write in VMware ESXi

CRITICAL 95KEV

VMware ESXi contains an arbitrary write vulnerability.

CVSS 3.1HIGH 8.2 Local High privileges No interaction EPSS 0.01016 Published 2025-03-04 Fixed in ESXi80U3d-24585383, ESXi80U2d-24585300 +1 CWE-123

TI-2025-16135 CVE-2025-22224 · GHSA-j652-46fv-w96g

Time-of-check time-of-use race condition in VMware ESXi

CRITICAL 99KEV

VMware ESXi, and Workstation contain a TOCTOU (Time-of-Check Time-of-Use) vulnerability that leads to an out-of-bounds write.

CVSS 3.1CRITICAL 9.3 Local No auth No interaction EPSS 0.01561 Published 2025-03-04 Fixed in ESXi80U3d-24585383, ESXi80U2d-24585300 +2 CWE-367

TI-2025-16133 CVE-2025-22222 · GHSA-9h7m-pf82-g666

VMware Aria Operations information disclosure vulnerability (CVE-2025-22222)

LOW 34

VMware Aria Operations contains an information disclosure vulnerability.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00548 Published 2025-01-30 Fixed in 8.18.3 CWE-497

TI-2025-16132 CVE-2025-22221 · GHSA-qrcx-78jp-35gm

VMware Aria Operations for Logs stored cross-site scripting vulnerability (CVE-2025-22221)

LOW 24

VMware Aria Operation for Logs contains a stored cross-site scripting vulnerability.

CVSS 3.1MEDIUM 5.2 Network High privileges User interaction EPSS 0.00391 Published 2025-01-30 Fixed in 8.18.3 CWE-79

TI-2025-16131 CVE-2025-22220 · GHSA-m777-hj92-cw6q

VMware Aria Operations for Logs broken access control vulnerability (CVE-2025-22220)

LOW 26

VMware Aria Operations for Logs contains a privilege escalation vulnerability.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00322 Published 2025-01-30 Fixed in 8.18.3 CWE-269

TI-2025-16130 CVE-2025-22219 · GHSA-j5gv-mwmr-ppp5

VMware Aria Operations for Logs stored cross-site scripting vulnerability (CVE-2025-22219)

MEDIUM 42

VMware Aria Operations for Logs contains a stored cross-site scripting vulnerability.

CVSS 3.1CRITICAL 9.0 Network Low privileges User interaction EPSS 0.00661 Published 2025-01-30 Fixed in 8.18.3 CWE-79

TI-2025-16129 CVE-2025-22218 · GHSA-x379-p5q2-7954

VMware Aria Operations for Logs information disclosure vulnerability

MEDIUM 40

VMware Aria Operations for Logs contains an information disclosure vulnerability.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00661 Published 2025-01-30 Fixed in 8.18.3 CWE-209

TI-2024-26061 CVE-2024-38834 · GHSA-m2m4-2g99-6625

Stored cross-site scripting vulnerability (CVE-2024-38834)

LOW 29

VMware Aria Operations contains a stored cross-site scripting vulnerability.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00332 Published 2024-11-26 Fixed in 8.18.2 CWE-79

TI-2024-26060 CVE-2024-38833 · GHSA-mff4-qp47-8h8q

Stored cross-site scripting vulnerability (CVE-2024-38833)

LOW 30

VMware Aria Operations contains a stored cross-site scripting vulnerability.

CVSS 3.1MEDIUM 6.8 Network Low privileges User interaction EPSS 0.00423 Published 2024-11-26 Fixed in 8.18.2 CWE-79

TI-2024-26059 CVE-2024-38832 · GHSA-6vqg-wm4f-f8vx

Stored cross-site scripting vulnerability (CVE-2024-38832)

LOW 32

VMware Aria Operations contains a stored cross-site scripting vulnerability.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.0044 Published 2024-11-26 Fixed in 8.18.2 CWE-79

TI-2024-26058 CVE-2024-38831 · GHSA-7mjq-fcrm-26pg

Local privilege escalation vulnerability (CVE-2024-38831)

LOW 36

VMware Aria Operations contains a local privilege escalation vulnerability.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00293 Published 2024-11-26 Fixed in 8.18.2 CWE-77

TI-2024-26057 CVE-2024-38830 · GHSA-88h9-qf46-pmjc

Local privilege escalation in VMware Aria Operations

LOW 35

VMware Aria Operations contains a local privilege escalation vulnerability.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00178 Published 2024-11-26 Fixed in 8.18.2 CWE-269

Vulnerabilities

Filters